TessariDB OAuth
Sign-in for your own applications: an OAuth 2.1 authorization server and OpenID provider whose state is kept in TessariDB. The documentation for 0.1.0.
TessariDB OAuth is an OAuth 2.1 authorization server and OpenID provider written in Rust. One binary serves the protocol endpoints, the sign-in and account pages your users see, and an admin console on a listener of its own. Tenants, users, clients, codes, grants, sessions, sealed signing keys and the audit trail are all records in a TessariDB store.
Status. These pages describe TessariDB OAuth 0.1.0, the first release, tagged
v0.1.0in the repository and published as the imagetessaridb/oauth:0.1.0. Everything they describe is served by the binary and covered by its tests; what is not built yet is said where it would matter. The configuration and the HTTP surface may still change in a minor release before 1.0.
Start here
- What it is: what it serves, the promises it keeps and what it deliberately leaves out.
- Running it: build it, point it at a TessariDB node, start it and make the first operator.
Then
- Protocol: clients and their keys, authorization, tokens, UserInfo, revocation and logout, endpoint by endpoint.
- Users and accounts: signing in, passkeys and second factors, password resets, and the account portal users manage themselves in.
- Administering: the admin console, operator roles, clients, signing keys, branding, mail and the audit trail.
- Operating: limits, logs and alerts, regions, incidents and backups.
The product page is oauth.tessaridb.com. The source is on GitHub under the Business Source License 1.1: production use is free, commercial use included, and a commercial licence is needed only to offer it to others as a hosted identity, authentication or authorization service, or to sell it.